fix(release): pin checkout ref to base repo to avoid v7 fork-PR refusal

[jmeridth]

Proposed Changes

actions/checkout v7.0.0 refuses to check out fork PR code under pull_request_target (the "pwn request" guard added in actions/checkout#2454). The create_release and release_goreleaser jobs leave ref unset, so under pull_request_target checkout defaults to refs/pull/N/merge. For any fork-originated PR this now fails with "Refusing to check out fork pull request code from a 'pull_request_target' workflow," which blocks the release entirely.

This pins both checkouts to base-repo refs so the guard is satisfied without opting into allow-unsafe-pr-checkout (that flag would suppress the guard while still pulling untrusted fork code, re-introducing the pwn-request exposure):

• create_release: ref: ${{ github.event.pull_request.base.ref || github.ref }}. Checks out the base branch tip for PR-triggered runs, with a fallback for workflow_dispatch. This tags the base branch tip at release time rather than a specific PR merge commit. The exact-merge refs (merge_commit_sha, head.sha, refs/pull/N/merge) are all in the checkout v7 guard's blocklist, so the base branch is the guard-safe choice, and tagging the accumulated base tip is appropriate for a release-drafter release.
• release_goreleaser: ref: ${{ needs.create_release.outputs.full-tag }}. Builds from the release tag, matching the existing release_image job.

release_image already pins ref to the tag, so it needs no change.

Verification

Per unsafe-pr-checkout-helper.ts, the refusal fires only when the resolved ref matches refs/pull/N/head|merge or resolves to a PR head/merge SHA; a base branch name or a release tag matches none of these, so the guard passes. actionlint and the repo's pre-commit hooks pass on the workflow.

Readiness Checklist

Author/Contributor

• If documentation is needed for this change, has that been included in this pull request (no user-facing docs change needed)

[Copilot]

Pull request overview

This PR updates the reusable release workflow’s actions/checkout steps to explicitly set ref, avoiding actions/checkout v7’s refusal to check out refs/pull/* under pull_request_target runs (notably for fork-originated PRs).

Changes:

• Pin create_release checkout to a base-repo ref instead of the implicit refs/pull/N/merge default.
• Pin release_goreleaser checkout to the newly created release tag (needs.create_release.outputs.full-tag) for consistency with the image release job.

Show a summary per file

File	Description
.github/workflows/release.yaml	Sets explicit checkout ref values in release jobs to avoid checkout v7 fork-PR refusal under pull_request_target.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Low

[zkoppert]

👍🏻

• create_release ref: base.ref || github.ref : for a merged fork PR,  base.ref  is  "main"  (a bare branch name), so checkout leaves input.commit undefined and  input.ref="main"  matches none of the three guard conditions. Guard passes, checks out the merged base branch.
• release_goreleaser ref: full-tag : a tag name (non-SHA) leaves  input.commit  undefined, so the guard passes. The tag is guaranteed present: the job  needs: create_release  and gates on  full-tag != '' , and the tag is pushed in  create_release  (lines 170-175). This also aligns it with the existing  release_image  job.
• workflow_dispatch  fallback github.ref: the guard early-returns for non-pull_request_target / workflow_run  events, so it is fine.